Vulnerability Disclosure Policy
Last updated: 1 October 2026
We welcome reports from security researchers and customers. If you believe you have found a security vulnerability in Prompteryx, please tell us privately so we can fix it before it is disclosed.
How to report
Email contact@prompteryx.ai with "Security" in the subject line. Please include the affected URL or component, the steps to reproduce, the impact you observed and any proof-of-concept. Do not include other people's personal data.
What to expect
- Acknowledgement within 2 business days.
- An initial assessment, including severity, within 5 business days.
- Updates at least every 14 days until the issue is resolved, and a note when it is fixed.
- Credit in our release notes if you would like it.
We do not currently run a paid bug bounty.
Scope
- prompteryx.ai and its subdomains, including the web app and APIs.
- The Prompteryx desktop plugin and browser extension.
- Our published SDK and CLI packages.
Out of scope: third-party services we use (report those to the provider), denial-of-service or load testing, social engineering or phishing of our staff or users, physical attacks, automated scanner output without a demonstrated impact, and missing best-practice headers without a working exploit.
Rules for good-faith research
- Only test against accounts you own or have explicit permission to use.
- Do not access, change or delete other users' data; if you encounter it, stop and tell us.
- Do not degrade the Service for others, and do not run automations against third-party sites through our cloud browser as part of testing.
- Give us a reasonable time to fix the issue before any public disclosure (we aim for 90 days).
If you follow these rules, we will consider your research authorised, will not pursue legal action against you for it, and will work with you to understand and resolve the issue quickly.
See also: Trust & Security · Privacy Policy · security.txt